What’s Vulnerable › Vulnerabilities

CVE-2022-4407: Cross-site Scripting (XSS) - Reflected in thorsten/phpmyfaq

• Severity: medium (CVSS 6.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 4.9% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2022-12-11 · updated 2026-06-17
• Weakness: CWE-79

Description

Cross-site Scripting (XSS) - Reflected in GitHub repository thorsten/phpmyfaq prior to 3.1.9.

Affected products

• thorsten phpMyFAQ: before 3.1.9 — fixed in 3.1.9

How to fix

Upgrade to a fixed version: thorsten phpMyFAQ 3.1.9. Check the vendor advisory for mitigations.

References

• https://github.com/thorsten/phpmyfaq/commit/1d73af34bf42764f9f9491c7ba5e9495d70e3ca5
• https://huntr.dev/bounties/a1649f43-78c9-4927-b313-36911872a84b
• https://github.com/MarkLee131/awesome-web-pocs/blob/main/CVE-2022-4407.md
• https://github.com/thorsten/phpmyfaq/commit/1d73af34bf42764f9f9491c7ba5e9495d70e3ca5
• https://huntr.dev/bounties/a1649f43-78c9-4927-b313-36911872a84b

Get alerted when CVE-2022-4407 or the next vulnerability affects your stack